Hardware wallets are an important tool for keeping crypto holdings safe, by isolating keys onto a separate piece of hardware that cannot be exploited to expose the key material and does not sign without an indication of user intent. Modern devices such as phones and laptops have secure enclaves that make a similar promise: holding keys securely and separate from the phone operating system, and only signing after checking user intent, e.g. via biometrics or a password.

Unfortunately, ordinary passkeys don’t provide this security. At least on Apple devices, the actual keys are stored outside of the enclave in system memory and also decrypted there. I have not found how other manufacturers handle this, and firm security claims are hard to find. In light of this, I would generally assume the worst.

But there is a way to get security similar to hardware wallets: use specialized hardware security keys such as YubiKeys, which will not export or back up your keys.

Hardware wallets and secure enclaves

Hardware wallets such as Ledger or Trezor allow users to handle crypto regularly while managing the risk. They provide some very important features that significantly reduce everyday risks:

  1. They store the keys securely on the wallet, typically not allowing a cleartext export once the key is set. It was quite controversial when Ledger introduced a backup functionality which does weaken this security model, and as we will see below, passkeys suffer a similar dilemma.
  2. They ideally provide clear signing – they display the transaction contents in a way that the user can make an informed choice whether to sign the transaction. This means that even if their main hardware is compromised to the extent that it actively hides the real transaction content and displays fake content instead, the user can still verify it on the independent hardware wallet display.

A mobile phone’s or laptop’s secure enclave does not have an independent display, so there is no way to implement clear signing. The best case is that it can achieve the first goal: never export the key material, and always check that the user is currently trying to sign a transaction by checking user presence with a prompt and biometrics. It’s not perfect security, but it does make attacks on vigilant users more difficult.

The key backup dilemma

As we discovered with Ledger Recovery, every manufacturer has to navigate a fundamental UX problem for their users. Users tend to lose their keys, which is just as bad as having all their assets stolen. The ideal solution minimizes the sum of those risks – and for many users, the risk of losing their keys is higher than having them stolen, so providing backups matters most.

While the secure enclave does provide secure keys that can never be exported, Apple has blocked access to these. Ever since passkeys launched in 2022 (iOS 16 and macOS Ventura), Apple has only issued ones that sync across devices via iCloud Keychain – there is no option to create a device-bound, non-synced one. In fact, the platform forces the WebAuthn “backup eligible” and “backup state” flags to be set, so relying parties can’t even distinguish a device-bound credential from a synced one, breaking the strict hardware security boundary.

Nicolas Bacca, the former CTO of Ledger, verified this and actually managed to extract the keys from the operating system after jailbreaking an iPhone (he presented this at Devcon 7). Sadly, Apple seems to have chosen the easy path and only uses the enclave to hold the encryption keys, while decryption and signing happen on unsecured hardware – and can be broken with OS exploits.

This means Apple passkeys should be treated like secrets stored in a password manager, and aren’t really secured by hardware as one might expect.

A more secure design

I think it is realistic that for most users, the ability to have a backup of their keys is more important than bulletproof hardware guarantees. Apple could, however, have built an enclave that, similar to Ledger, only allows an encrypted export to Apple’s secured network and otherwise keeps the keys and signing inside the enclave.

My recommendations

Normal passkeys stored on phones or in password managers should be treated as hot wallets. I would not secure significant amounts of money with them, but they provide great UX for quickly onboarding users and securing small amounts of money for everyday use.

YubiKeys and other security devices provide a real improvement on this and behave more similar to a hardware wallet – though they aren’t immune to dedicated attacks either, as the EUCLEAK side-channel attack on older YubiKey 5 firmware showed. They also come with the downside that they can’t be backed up at all, so they are only useful in a multisig configuration. For most users a hardware wallet will still be the more convenient choice, and it allows a paper backup and clear signing.

So, is a passkey a hardware wallet integrated into your phone? With Apple’s current implementation (and most likely other manufacturer’s as well), the honest answer is no – it’s closer to a password manager than to a hardware wallet.